RedCursorSecurityConsulting/PPLKiller
Some data may be outdated — see provenance labels.
Tool to bypass LSA Protection (aka Protected Process Light) observed · 2026-09-30
Health v2 · maintenance only
10/100
- Activity 0
- Release rhythm 35
- Longevity 100
Flags: no_releases archived no_license
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-10-22. Adoption (stars, forks) is never an input.
- gap_med: n/a
- age_days: 2298
- days_rel: n/a
- days_push: 1417
- n_releases_24m: 0
Adoption not part of the score
995 stars · 148 forks observed · 2026-09-30
What it is AI-extracted, prompt v1, taxonomy v1, 2026-09-07, confidence 0.92
PPLKiller is a C++ command-line tool that bypasses Windows LSA Protection (Protected Process Light) by installing a signed kernel driver to strip protection flags from protected processes. It is a red-team demonstration tool showing that LSA Protection alone does not stop credential extraction attacks like Mimikatz.
Use cases
- bypass lsa protection on windows
- disable protected process light from command line
- red team tool to strip ppl flags from lsass
- demonstrate that lsa protection does not stop mimikatz
- test credential guard mitigations against driver-based attacks
When to choose
- you are a red teamer or security researcher demonstrating LSA Protection bypass on Windows
- you need a simple driver-based tool to disable PPL before credential extraction
- you are evaluating whether Credential Guard or WDAC policies block driver-based PPL bypasses
When to avoid
- you need a maintained tool with runtime offset support - use PPLcontrol or EDRSandblast instead
- you want a defensive tool - this is offensive-only
- you cannot load kernel drivers due to WDAC or HVCI restrictions
- you need a no-driver approach - consider PPLdump, though it is patched on recent Windows
Facets
cli-tool · maturity maintenance
security penetration-testing cli security penetration-testing windows windows cpp lsa-protection ppl-bypass credential-dumping kernel-driver red-team windows-security
1 source
- readme: https://github.com/RedCursorSecurityConsulting/PPLKiller · fetched 2026-09-30 · bfea9759aafd
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| RedCursorSecurityConsulting/PPLKiller | main | 10 |
For agents
markdown · JSON · MCP: product_card(name="RedCursorSecurityConsulting/PPLKiller")
Data as of 2026-10-19T08:05:51.212177+00:00 · Report a problem